~/home/news/zero-click-audio-exploit-chains-pixel-9-project-ze-2026-01-17
newsSaturday, January 17, 20268 min read👁 18 views

Zero-Click Audio Exploit Chains Pixel 9: Project Zero’s Critical Findings

Project Zero has uncovered a multi-stage zero-click exploit chain that compromises Pixel 9 devices without any user interaction. The chain stitches together two new CVEs in the Dolby audio decoder and a kernel driver, prompting an emergency patch rollout for Android 14 users.

Zero-ClickAndroidPixel9ProjectZero

Overview

On January 16 2026, Google’s elite research team Project Zero published a detailed analysis of a previously unknown zero-click exploit chain that targets the Google Pixel 9 smartphone. The chain requires no user interaction - the malicious payload is delivered via audio attachments in SMS or RCS messages and automatically processed by Google Messages’ AI-driven transcription service. By chaining together vulnerabilities in the Dolby Unified Decoder, a low-level driver, and the Android kernel, threat actors can achieve arbitrary code execution with system-level privileges, effectively bypassing the Android sandbox model.

Technical Details

CVE Summary

  • CVE-2025-54957: Integer overflow in the Dolby Digital Plus (EAC-3) decoder (libcodec2_soft_ddpdec.so). The overflow occurs while parsing Extensible Metadata Delivery Format (EMDF) payloads, allowing out-of-bounds writes into the decoder’s heap.
  • CVE-2025-36934: Use-after-free in a kernel driver exposed to the decoder’s sandboxed process. The driver mishandles reference counting of a shared buffer, enabling a controlled data-corruption primitive.

Attack Vector

The exploit begins with three specially crafted MP4 containers attached to a text message. When the message arrives, Google Messages automatically extracts the audio track and hands it to the Dolby Unified Decoder for transcription. Because the decoder runs in a privileged mediacodec service, the attacker’s payload executes in a context that can later interact with kernel-level components.

Exploitation Methodology

Project Zero’s proof-of-concept (PoC) follows a classic multi-stage approach:

  1. Stage 1 - Heap Corruption: CVE-2025-54957 is triggered by feeding a malformed EMDF payload that overflows a buffer, corrupting adjacent allocations in the Scudo allocator’s “evo heap”. The PoC crafts a WRITE DYNAMIC FAST primitive that overwrites metadata of a neighboring object.
  2. Stage 2 - Function Pointer Hijack: The corrupted object is a MediaCodec callback structure. By overwriting its vtable entry, the attacker redirects execution to a controlled code region located in the same process’s address space.
  3. Stage 3 - Privilege Escalation: The overwritten pointer triggers a call into the vulnerable driver (CVE-2025-36934). The driver’s use-after-free bug is exploited to gain a kernel-mode write primitive, which finally overwrites the cred structure of the current task, granting root privileges.

Throughout the chain, the researchers bypass partial ASLR by leveraging predictable allocation patterns in the Scudo arena and by leaking a 32-bit address from the decoder’s log buffer. The final payload spawns a system shell that can install a persistent backdoor or exfiltrate data silently.

Impact Analysis

The vulnerability primarily affects:

  • Google Pixel 9 smartphones running Android 14, shipped from November 2025 onward.
  • Any Android device that includes the same Dolby Unified Decoder library (/vendor/lib64/libcodec2_soft_ddpdec.so) and the vulnerable driver - this includes some Samsung Galaxy S series devices and certain OEM tablets that source the decoder from Google’s AOSP build.
  • Enterprise mobile deployments that rely on automated message transcription for voice-to-text services, as the attack surface is amplified by AI-driven processing.

Given the zero-click nature, the exploit is highly attractive to nation-state actors and sophisticated cyber-crime groups. Successful exploitation yields full device compromise, enabling credential theft, espionage, ransomware deployment, and lateral movement within corporate networks.

Timeline of Events

  • 2025-11-02: Initial discovery of CVE-2025-54957 during internal fuzzing of the Dolby decoder.
  • 2025-12-15: Separate discovery of CVE-2025-36934 in the kernel driver by an independent security researcher.
  • 2026-01-06: Project Zero correlates the two findings and constructs a working exploit chain.
  • 2026-01-10: Google is notified under its responsible-disclosure policy.
  • 2026-01-14: Google releases an emergency security patch (Android 14.0.0-r2) addressing both CVEs.
  • 2026-01-16: Project Zero publishes the full technical blog post (source: Cyber Press).
  • 2026-01-18: Google accelerates rollout to 95 % of Pixel 9 devices worldwide.

Mitigation / Recommendations

For individuals and organizations alike, the following steps are essential:

  1. Update Immediately: Install the latest Android 14 security patch (or later) via the Settings → System → Advanced → System update menu. Enterprises should push the update through their Mobile Device Management (MDM) platform.
  2. Disable Automatic Media Processing: Where possible, turn off AI-driven transcription in Google Messages or any third-party messaging app that auto-processes audio attachments.
  3. Restrict RCS/SMS Attachments: Implement policies that block or quarantine unknown media files received over SMS/RCS, especially from unverified numbers.
  4. Monitor for Indicators of Compromise (IoCs): Look for anomalous mediacodec processes spawning privileged shells, unexpected system_server restarts, or unknown binaries placed in /data/local/tmp.
  5. Enterprise Hardening: Enforce “Zero-Trust” network segmentation for mobile devices, limit privileged app installations, and regularly audit app permissions.

Real-World Impact

The exploit’s zero-click nature means that a single malicious message can silently compromise thousands of devices before any user even opens the message. In a corporate setting, an attacker could gain footholds on devices that have access to corporate email, VPN credentials, and internal resources, effectively bypassing traditional perimeter defenses.

For high-value targets-executives, journalists, and government officials-the attack offers a stealthy avenue for surveillance. The fact that the vulnerable component is shared across multiple OEMs widens the potential victim pool, raising concerns for supply-chain security in the mobile ecosystem.

Expert Opinion

From a senior analyst’s perspective, this incident underscores two critical trends in mobile security:

  • Zero-Click Attacks Are Becoming Mainstream: The barrier to entry for creating a functional zero-click exploit has lowered thanks to widespread adoption of AI-driven media processing. Attackers can now weaponize routine user-experience features (like transcription) to gain immediate code execution.
  • Shared Media Libraries Are a Double-Edged Sword: The Dolby Unified Decoder is a high-performance component used across Android, iOS, and many embedded devices. A single flaw in such a library propagates to a massive attack surface, emphasizing the need for rigorous third-party component vetting and rapid patch distribution.

Google’s rapid emergency patch rollout is commendable, but the incident also reveals a gap in the “auto-update” ecosystem for enterprise-managed devices, where policy-driven rollout delays can leave fleets vulnerable for weeks. Organizations should revisit their update cadence and consider “forced” security patches for critical CVEs.

Looking ahead, we can expect more exploitation of AI-enabled pipelines (speech-to-text, image recognition) as attackers seek non-interactive vectors. Defense-in-depth strategies-sandbox hardening, strict media handling policies, and continuous threat-intel monitoring-will be essential to mitigate this emerging class of threats.